I built three focused test implementations for replay, idempotency, and refresh-token races—failure paths I take seriously when building real systems. The screenshots document retired browser demos; the Node tests ran locally, and the implementation repositories are private. These are deliberately small reconstructions, not customer screenshots.
A local challenge guard that binds principal, action and expiry to one consume decision.
Archived screenshot of the former synthetic browser demonstration, captured November 5, 2026.
Reproduced test observations
1 successful consume and 199 replay rejections among 200 Promise-scheduled attempts; 5 of 5 tests passed.
npm test · 5/5 passed
These tests schedule calls in one process; they don't measure network throughput.
Failure cases and limitations
An action or principal mismatch is rejected; expired challenges and reused challenges are rejected.
This uses one process and an in-memory map. It does not perform Apple App Attest, Google Play Integrity, durable distributed claims, or network transactions.
Architecture and trust boundaries
Client-controlled input
1. Client request
Presents one-time challenge, principal and action.
Local server decision
2. Binding check
Compare requested action and principal with minted context.
Single-process simulation
3. Atomic local consume
Synchronously claim the token in one JavaScript process.
Local server decision
4. Decision
First caller accepts; later/replayed attempts fail.
Diagram of the tested reference model, not a production architecture or telemetry trace. Client inputs remain untrusted even when an integrity signal is valid.
Tenant-scoped operation keys, matching request fingerprints and a shared effect callback.
Archived screenshot of the former synthetic browser demonstration, captured November 5, 2026.
Reproduced test observations
1 side-effect callback across 100 concurrent scheduled requests; all 6 of 6 tests passed.
npm test · 6/6 passed
These tests schedule calls in one process; they don't measure network throughput.
Failure cases and limitations
Mismatched payload fingerprint is rejected; tenants remain isolated; uncertain responses stay retained during the key window.
In-process Promise scheduling is not a distributed exactly-once guarantee. No live database transaction, external payment provider or worker crash is tested.
Architecture and trust boundaries
Client-controlled input
1. API callers
100 calls reuse one tenant and idempotency key.
Local server decision
2. Fingerprint
Check tenant, operation and canonical request intent.
Single-process simulation
3. Local claim
One promise path owns the side-effect callback.
Local server decision
4. Result replay
Return the retained outcome to duplicate requests.
Diagram of the tested reference model, not a production architecture or telemetry trace. Client inputs remain untrusted even when an integrity signal is valid.
Single-use refresh credentials with token-family generation, revocation and expiry.
Archived screenshot of the former synthetic browser demonstration, captured November 5, 2026.
Reproduced test observations
1 successor credential issued from 200 presentations of the same refresh token; all 5 of 5 tests passed.
npm test · 5/5 passed
These tests schedule calls in one process; they don't measure network throughput.
Failure cases and limitations
Already-consumed tokens, revoked families, expired credentials and malformed inputs are rejected.
A single in-memory token family is not a production identity service. Multi-process atomic rotation, storage persistence and operational recovery need separate testing.
Architecture and trust boundaries
Client-controlled input
1. Refresh caller
Presents a bearer refresh credential.
Local server decision
2. Family validation
Check generation, expiry, active family and revocation.
Single-process simulation
3. Consume old token
Local synchronous one-time state transition.
Local server decision
4. Issue successor
Exactly one new generation; replay attempts fail.
Diagram of the tested reference model, not a production architecture or telemetry trace. Client inputs remain untrusted even when an integrity signal is valid.
All three projects passed their local Node tests on November 5, 2026. They use scheduled promises in one process, so they don't prove that the same logic is safe across workers or regions. The diagrams and screenshots show my standalone demos rather than any customer infrastructure. The engineering patterns apply beyond the examples, but the recorded test results belong to these exact implementations.
